How to manage AWS EC2 and Lightsail servers from one Windows app

• The RemoteAccessApp app on Windows 10 or 11, version 0.12.20 or later. Download it if you haven't yet.
• Access to the AWS console with permission to create an IAM user and a policy.
• For Linux instances, the .pem key file of the key pair you launched them with, if you want to sign in with it.

1. 1

   Step 1: Create an IAM user just for RemoteAccessApp

   In the AWS console, go to IAM → Users → Create user. Give it a name such as remoteaccessapp. It doesn't need console access. A separate user means you can see what it does and switch it off without touching anything else.

2. 2

   Step 2: Give it the read-only policy

   In the app, open the Connections page, click the arrow next to Add host and choose Cloud accounts…, then AWS (EC2 and Lightsail). Under Give it only what it needs, click Copy read-only policy. In IAM, go to Policies → Create policy → JSON, paste it, save it and attach it to the new user.

3. 3

   Step 3: Create an access key

   On the user's Security credentials tab, choose Create access key and Third-party service. Copy the access key ID and the secret access key; AWS shows the secret only once.

4. 4

   Step 4: Add the account in the app

   Back in Cloud accounts, paste the Access key ID and the Secret access key, and give the account a name if you like. Tick EC2 instances, Lightsail instances or both, then tick your regions, type others separated by commas, or choose All regions enabled for the account.

   Click Test connection. It says which AWS account and user the key belongs to and whether it can list EC2 and Lightsail instances. Then Save.

5. 5

   Step 5: Import the servers

   Click Import servers… (or Import from the cloud… in the Add host menu). The list shows each instance with its type, address, region, state and OS, and whether it's New or Already saved. Tick the ones you want, or use Only new.

   Linux instances become SSH hosts on port 22, Windows instances Remote Desktop hosts on port 3389. Under Key for the Linux servers, choose your .pem file and it's added to your key list once and used by the imported SSH hosts. Then click Import.

The same Cloud accounts window works for other providers too, so you can manage Azure VMs and DigitalOcean Droplets from the same list.

This is the policy the app copies for you. It can list servers, and nothing else:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RemoteAccessAppImport",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeRegions",
        "ec2:DescribeImages",
        "lightsail:GetInstances",
        "lightsail:GetInstance",
        "lightsail:GetRegions"
      ],
      "Resource": "*"
    }
  ]
}

ec2:DescribeImages is optional: the app only uses it to read the image name and guess the login user. Without it, EC2 Linux hosts get ec2-user. lightsail:GetRegions is needed to list Lightsail at all.

• Folder: imported servers go in a folder called Cloud, or tick A folder per region or resource group for folders like AWS · ap-southeast-2 and AWS Lightsail · us-east-1.
• Connect to private IPs instead of public ones, for instances you reach over a VPN or from inside the same VPC.
• Add their tags: your instance tags become host tags such as env:prod, so you can filter by them.
• Hosts already saved: Update them (the default for the cloud), Skip them or Add them again. An update only changes a host's address; the name, user, port, folder, saved password and key you chose stay.

The login user comes from the image: Lightsail uses its own user name, and for EC2 the app reads the image name (ubuntu for Ubuntu, admin for Debian, centos, fedora, rocky or bitnami for those images, otherwise ec2-user). Windows hosts use Administrator; you type the Windows password when you connect. Terminated instances aren't offered.

An imported host has a small AWS or Lightsail badge on its row, with its state when it isn't running, such as AWS · stopped. Hover it for the region and state. Right-click the host (or use its ⋯ menu) and open the submenu named after the badge:

• Start runs straight away. Stop… and Reboot… ask first, because anyone connected is disconnected.
• The row's state updates on its own while the instance starts or stops, for up to 3 minutes.
• Refresh from cloud reads the state and address again at any time. Refresh its hosts in Cloud accounts does the same for every host from that account.

For these you need the second policy: in Cloud accounts, click Copy policy with start/stop. It adds ec2:StartInstances, ec2:StopInstances, ec2:RebootInstances, lightsail:StartInstance, lightsail:StopInstance and lightsail:RebootInstance. If a permission is missing, the error names it. The help article on cloud servers at AWS, DigitalOcean and Azure lists the permissions each provider needs.

For Linux, the key you chose at import is the one in your key list under Keys & passwords; you can pick another per host. On the first connection, check the server's key fingerprint before you trust it (see server keys). The SSH guide covers the rest, and SSH keys covers .pem and .ppk files.

For Windows instances, AWS gives you the Administrator password in its console, decrypted with the key pair you launched the instance with. The instance's security group has to allow Remote Desktop from where you are.

Your PC talks to AWS directly; nothing goes through RemoteAccessApp's servers. The secret access key (and a session token, if you use temporary credentials) is stored encrypted for your Windows account, is never shown again after you save it, and is never written to logs. Lists show the key ID masked. How we handle these keys is also covered in one place for your cloud servers and your PCs.

With Save to my vault on and your password vault syncing (Pro), the account is also kept in your end-to-end encrypted vault, so your other PCs get it. Without the vault, or on the free plan, it stays on the PC where you added it, and imported hosts still sync to your other PCs like any other host. The app doesn't read AWS CLI profile or SSO files.

Cloud accounts, importing and start, stop and reboot work on the free plan. Imported servers are ordinary saved hosts, so they count toward the free plan's 5 saved hosts and web panels; to import more, untick some or get Pro. AI assistants can also list and start or stop these servers through the MCP Desktop Connection (Pro), and they always ask you first.